Security Problem With Process Env

[PedroGSantos]

I have a problem using the current code using process.env in the config file of vite. Currently, the process.env from Node.JS invokes all enviroment variables from the SO. Consequently, when we build the application, we can see all enviroment variables by searching in the developer tools of the browser.

Here's an example

• Creating a password env variable:
  

• Searching for this variable and others from the SO:
  

Especially in a CI/CD flow, this is a crucial problem because a host that runs a CI/CD flow can have password env variables in the SO.

To solve this, I just removed the function that invoke all SO env, I created a .env file and I use this guidelines provided by VITE to create env variable: https://vitejs.dev/guide/env-and-mode#env-files

This guidelines specify that we need to create a env with the prefix VITE and references like this console.log(import.meta.env.VITE_SOME_KEY)

Enviroment:

• Browser: Google Chrome 123.0.6312.58
• SO: Ubuntu 22.04.4 LTS

[PedroGSantos]

Do I need to create a issue for this PR?

@mrholek